CVE-2026-114432

Name of the Vulnerable Software and Affected Versions Contact Form 7 versions prior to 6.2.4

Description An unauthenticated file upload flaw allows remote attackers to upload arbitrary files to a site through a form file field because the plugin fails to validate file types or extensions. A failure in the temporary-file cleanup process ensures the uploaded file remains on the disk. This issue potentially affects over 5 million WordPress sites. On stock Debian or Ubuntu Apache configurations that list directory contents and map .phar files to the PHP handler, this can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server. On other configurations, such as nginx or Apache with .htaccess overrides, the flaw allows arbitrary files to be written into the uploads directory, which may be served as active content like HTML or SVG.

Recommendations Update Contact Form 7 to version 6.2.4 or later.